Notwithstanding Article 28-8, personal information controllers in a country that restricts cross-border transfers of personal information may be subject to restrictions at a level equivalent to those imposed by the country: Provided, That this shall not apply where cross-border transfers are necessary to implement a treaty or other international conventions.